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Claims 

1. A method of scanning electronic files for computer viruses, the method 
comprising: 

5 identifying at a first node of a computer network, electronic files which require 

to be scanned for computer viruses; 

initiating a dialogue between said first node and a second node of the network, 
the second node comprising a virus scanning application, during which dialogue the 
second node identifies to the first node one or more portions of the electronic file 
10 required by the virus scanning application; and 

transferring the identified portion(s) from the first node to the second node over 
the network. 

2. A method according to claim 1 and comprising identifying electronic files which 
15 require virus scanning, at a plurality of first nodes of the computer network and 

initiating a dialogue between the first nodes and the said second node when appropriate. 

3. A method according to claim 1, wherein the first node and the second node are 
located at respective different locations in the computer network. 

20 

4. A method according to claim 1, wherein the first node is one of a database 
server, electronic mail server, an Internet server, a proxy server, or a firewall server. 

5. A method according to claim 1, wherein the dialogue is carried out using a 
25 network protocol carried by IP. 

6. A method according to claim 1 and comprising analysing the file portions 
received at the second node to determine whether or not the file contains a virus or 
cannot be guaranteed to not contain a virus, and returning the result to the first node 

30 over the network. 

7. A method according to claim 6 and comprising transferring from the second 
node to the first node data portions to be written into the file to disinfect the file. 
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8. A method according to claim 6 and comprising sending instructions from the 
second node to the first node to inform the first node how to disinfect the file. 

5 9. An anti-virus scanning system for use in scanning electronic files in a computer 
network, the system comprising: 

a first computer having processing means arranged to identify electronic files 
which should be scanned for computer viruses; and 

a second computer having processing means arranged to perform a virus 
1 0 scanning operation, 

the first computer further comprising communication means for initiating a 
dialogue between the first computer and the second computer, during which the second 
computer identifies to the first computer those portions of the electronic files required 
by the first computer for performing the virus scanning operation, and for transferring 
1 5 those portions to the second computer. 

10. A computer memory encoded with executable instructions representing a 
computer program for causing a first computer connected to a computer network to: 

identify electronic files which require to be scanned for computer viruses; 
20 initiate a dialogue between the first computer and a second computer also 

connected to the computer network; 

receive from the second computer an identification of portions of the electronic 
file which are required for virus scanning of the electronic files at the second computer; 
and 

25 transfer the identified portion from the first computer to the second computer. 

11. A computer memory encoded with executable instructions representing a 
computer program for causing a first computer connected to a computer network to: 

receive a dialogue initiation request from a second computer also connected to 
30 the computer network concerning an electronic file identified by the second computer as 
requiring a virus scan; 
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identify to the second computer those portions of the electronic file which are 
required by the first mentioned computer for performing a virus scanning operation at 
the first computer; and 

receive the identified portions of the electronic file from the first node. 

5 

12. A method of disinfecting an electronic file stored at a first node of a computer 
network, after the file has been identified as containing a virus by a virus scanning 
engine located at a second network node, the method comprising: 

sending from the second node to the first node, data portions to be written into 
10 the infected file and/or instructions for disinfecting the file; and 

receiving the data portions and/or instructions at the first node and writing the 
data portions into the infected file and/or carrying out said instructions. 

13. A method according to claim 12, wherein said first and second nodes are 
15 respective computer workstations coupled to a common network. 

14. A method according to claim 13, wherein the workstation corresponding to the 
second node is arranged to communicate with a plurality of workstations corresponding 
to respective second nodes. 

20 



